EUVD-2026-39945
GHSA-94x4-66r8-cqx9
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Network-exploitable with no auth or complexity; confidentiality limited to form data, no integrity or availability impact.
Primary rating from Vendor (wordfence).
CVSS VectorVendor: wordfence
Lifecycle Timeline
2DescriptionCVE.org
The NEX-Forms - Ultimate Forms Plugin for WordPress plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 9.2.2. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to enumerate sequential report IDs and download complete form submission data - including names, email addresses, phone numbers, postal addresses, payment details, and uploaded file paths - for any saved report on the site.
AnalysisAI
Unauthenticated form submission data exfiltration in NEX-Forms - Ultimate Forms Plugin for WordPress (all versions through 9.2.2) exposes sensitive PII and payment details to any remote attacker. Missing authorization checks on report download endpoints allow sequential enumeration of report IDs without any credentials, enabling mass harvesting of names, email addresses, phone numbers, postal addresses, payment details, and file paths from every saved form report on the site. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog, though the low attack complexity and zero authentication requirement make opportunistic exploitation straightforward.
Technical ContextAI
NEX-Forms is a WordPress form-builder plugin (slug: nex-forms-express-wp-form-builder) that stores submitted form data as sequentially numbered 'reports' accessible via plugin-specific endpoints. The root cause is CWE-862 (Missing Authorization): the plugin's report download handler in main.php (confirmed at lines 3648, 3654, and 3792 in both the 9.1.12 and 9.2.2 tagged releases in the WordPress SVN repository) does not invoke any capability or nonce check before serving report content to the requesting user. Because report IDs are sequential integers, an unauthenticated attacker can iterate numerically from ID 1 upward to enumerate all saved reports. The affected code paths are confirmed present in two distinct tagged releases, establishing that the flaw spans the full version history up to and including 9.2.2.
RemediationAI
Update NEX-Forms to the version released after 9.2.2 once available; a code change (changeset revision 3584399 in the WordPress SVN repository) has been committed upstream but the exact released patched version number is not independently confirmed from available data - monitor the WordPress.org plugin page and the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/ecf39f38-a476-47a8-a632-986b851895a6 for a confirmed fixed release. As an interim compensating control, site administrators can restrict access to the plugin's report download endpoints at the web server or WAF layer by blocking unauthenticated requests to the relevant WordPress admin-ajax or REST API routes used by NEX-Forms for report retrieval; trade-off is that this may break legitimate authenticated report access if the rule is too broad. If form submission storage is not required, disabling the report-saving feature within the plugin reduces the attack surface immediately with no data-exfiltration risk. Operators should also audit existing saved reports for sensitive data and consider notifying affected form submitters if payment or PII data has been stored.
The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra para
The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail comman
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The AI Engine WordPress plugin through version 3.1.3 exposes Bearer Token values through the /mcp/v1/ REST API endpoint
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
Remote code execution in WordPress 6.9.x (before 6.9.5) and 7.0.x (before 7.0.2) arises from a REST API batch endpoint r
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today